Node.js › HTTP & HTTPS Modules

How does Node's node:https module differ from node:http, and what additional configuration does it require?

Intermediate

Answer

The https module provides the same API surface as http but wraps connections in TLS encryption -- creating an HTTPS server requires providing a TLS certificate and private key (either self-signed for development, or issued by a trusted certificate authority like Let's Encrypt for production), whereas plain http requires no such configuration at all since it transmits data unencrypted.

const https = require('node:https');
const fs = require('node:fs');

const options = {
  key: fs.readFileSync('private-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
};

https.createServer(options, (req, res) => {
  res.end('Secure response');
}).listen(443);

Real-world example A production Node.js application typically doesn't run its own https.createServer() at all -- instead, TLS termination is handled by a reverse proxy like Nginx or a cloud load balancer in front of it, with the Node.js process itself only ever handling plain HTTP behind that already-secured boundary.

Common follow-ups: Why is it more common in production to terminate TLS at a reverse proxy rather than directly within the Node.js process?;How would you configure automatic certificate renewal using a service like Let's Encrypt for a directly-exposed HTTPS Node.js server?

Security;Cloud & DevOps